[Python-checkins] cpython (merge 3.1 -> 3.1): Merge 3.1

Wed Mar 30 13:56:53 CEST 2011

http://hg.python.org/cpython/rev/8e074d9b1587
changeset: 69066:8e074d9b1587
branch: 3.1
parent: 69062:9a6da9bc257d
parent: 69059:36344c9505b2
user: Kristjan Valur Jonsson <sweskman at gmail.com>
date: Wed Mar 30 11:54:13 2011 +0000
summary:
 Merge 3.1
files:
 Doc/library/urllib.request.rst | 4 +++
 Lib/test/test_urllib.py | 16 +++++++++++++
 Lib/test/test_urllib2.py | 24 +++++++++++++++++++
 Lib/urllib/request.py | 27 ++++++++++++++++++++++
 Misc/NEWS | 3 ++
 Modules/_collectionsmodule.c | 2 +-
 6 files changed, 75 insertions(+), 1 deletions(-)

diff --git a/Doc/library/urllib.request.rst b/Doc/library/urllib.request.rst
--- a/Doc/library/urllib.request.rst
+++ b/Doc/library/urllib.request.rst
@@ -783,6 +783,10 @@
 is the case, :exc:`HTTPError` is raised. See :rfc:`2616` for details of the
 precise meanings of the various redirection codes.
 
+ An :class:`HTTPError` exception raised as a security consideration if the
+ HTTPRedirectHandler is presented with a redirected url which is not an HTTP,
+ HTTPS or FTP url.
+
 
 .. method:: HTTPRedirectHandler.redirect_request(req, fp, code, msg, hdrs, newurl)
 
diff --git a/Lib/test/test_urllib.py b/Lib/test/test_urllib.py
--- a/Lib/test/test_urllib.py
+++ b/Lib/test/test_urllib.py
@@ -2,6 +2,7 @@
 
 import urllib.parse
 import urllib.request
+import urllib.error
 import http.client
 import email.message
 import io
@@ -183,6 +184,21 @@
 finally:
 self.unfakehttp()
 
+ def test_invalid_redirect(self):
+ # urlopen() should raise IOError for many error codes.
+ self.fakehttp(b'''HTTP/1.1 302 Found
+Date: 2008年1月02日 03:03:54 GMT
+Server: Apache/1.3.33 (Debian GNU/Linux) mod_ssl/2.8.22 OpenSSL/0.9.7e
+Location: file://guidocomputer.athome.com:/python/license
+Connection: close
+Content-Type: text/html; charset=iso-8859-1
+''')
+ try:
+ self.assertRaises(urllib.error.HTTPError, urlopen,
+ "http://python.org/")
+ finally:
+ self.unfakehttp()
+
 def test_empty_socket(self):
 # urlopen() raises IOError if the underlying socket does not send any
 # data. (#1680230)
diff --git a/Lib/test/test_urllib2.py b/Lib/test/test_urllib2.py
--- a/Lib/test/test_urllib2.py
+++ b/Lib/test/test_urllib2.py
@@ -9,6 +9,7 @@
 # The proxy bypass method imported below has logic specific to the OSX
 # proxy config data structure but is testable on all platforms.
 from urllib.request import Request, OpenerDirector, _proxy_bypass_macosx_sysconf
+import urllib.error
 
 # XXX
 # Request
@@ -985,6 +986,29 @@
 self.assertEqual(count,
 urllib.request.HTTPRedirectHandler.max_redirections)
 
+
+ def test_invalid_redirect(self):
+ from_url = "http://example.com/a.html"
+ valid_schemes = ['http','https','ftp']
+ invalid_schemes = ['file','imap','ldap']
+ schemeless_url = "example.com/b.html"
+ h = urllib.request.HTTPRedirectHandler()
+ o = h.parent = MockOpener()
+ req = Request(from_url)
+ req.timeout = socket._GLOBAL_DEFAULT_TIMEOUT
+
+ for scheme in invalid_schemes:
+ invalid_url = scheme + '://' + schemeless_url
+ self.assertRaises(urllib.error.HTTPError, h.http_error_302,
+ req, MockFile(), 302, "Security Loophole",
+ MockHeaders({"location": invalid_url}))
+
+ for scheme in valid_schemes:
+ valid_url = scheme + '://' + schemeless_url
+ h.http_error_302(req, MockFile(), 302, "That's fine",
+ MockHeaders({"location": valid_url}))
+ self.assertEqual(o.req.get_full_url(), valid_url)
+
 def test_cookie_redirect(self):
 # cookies shouldn't leak into redirected requests
 from http.cookiejar import CookieJar
diff --git a/Lib/urllib/request.py b/Lib/urllib/request.py
--- a/Lib/urllib/request.py
+++ b/Lib/urllib/request.py
@@ -528,6 +528,17 @@
 
 # fix a possible malformed URL
 urlparts = urlparse(newurl)
+
+ # For security reasons we don't allow redirection to anything other
+ # than http, https or ftp.
+
+ if not urlparts.scheme in ('http', 'https', 'ftp'):
+ raise HTTPError(newurl, code,
+ msg +
+ " - Redirection to url '%s' is not allowed" %
+ newurl,
+ headers, fp)
+
 if not urlparts.path:
 urlparts = list(urlparts)
 urlparts[2] = "/"
@@ -1864,8 +1875,24 @@
 return
 void = fp.read()
 fp.close()
+
 # In case the server sent a relative URL, join with original:
 newurl = urljoin(self.type + ":" + url, newurl)
+
+ urlparts = urlparse(newurl)
+
+ # For security reasons, we don't allow redirection to anything other
+ # than http, https and ftp.
+
+ # We are using newer HTTPError with older redirect_internal method
+ # This older method will get deprecated in 3.3
+
+ if not urlparts.scheme in ('http', 'https', 'ftp'):
+ raise HTTPError(newurl, errcode,
+ errmsg +
+ " Redirection to url '%s' is not allowed." % newurl,
+ headers, fp)
+
 return self.open(newurl)
 
 def http_error_301(self, url, fp, errcode, errmsg, headers, data=None):
diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -58,6 +58,9 @@
 - Issue #11659: Fix ResourceWarning in test_subprocess introduced by #11459.
 Patch by Ben Hayden.
 
+- Issue #11662: Make urllib and urllib2 ignore redirections if the
+ scheme is not HTTP, HTTPS or FTP (CVE-2011-1521).
+
 - Issue #5537: Fix time2isoz() and time2netscape() functions of
 httplib.cookiejar for expiration year greater than 2038 on 32-bit systems.
 
diff --git a/Modules/_collectionsmodule.c b/Modules/_collectionsmodule.c
--- a/Modules/_collectionsmodule.c
+++ b/Modules/_collectionsmodule.c
@@ -913,7 +913,7 @@
 PyDoc_STRVAR(deque_doc,
 "deque(iterable[, maxlen]) --> deque object\n\
 \n\
-Build an ordered collection accessible from endpoints only.");
+Build an ordered collection with optimized access from its endpoints.");
 
 static PyTypeObject deque_type = {
 PyVarObject_HEAD_INIT(NULL, 0)
-- 
Repository URL: http://hg.python.org/cpython
